Install

The install step proves the repository can be restored from versioned inputs: `package.json`, lockfile, package-manager version, and registry configuration. It must be deterministic, non-mutating, and free from undeclared local dependencies.

| Command | When | |---------|------| | `npm ci` | CI: exact lockfile install, fail on drift | | `pnpm install --frozen-lockfile` | Same guarantee for pnpm | | `yarn install --immutable` | Same guarantee for Yarn Berry |

					# GitHub Actions sketch
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'
- run: npm ci
				

Pin the package manager with `packageManager` in root `package.json` or Corepack so laptops and CI use the same tool version. Cache keys should hash the lockfile and platform inputs that affect resolution.

On interviews: frozen lockfiles, pnpm/npm/Yarn CI modes, Corepack, dependency caching, private registry auth, and why a developer's `node_modules` is not authoritative.

Common pitfalls: caching `node_modules` with weak keys hides dependency drift; allowing CI to rewrite a lockfile makes builds non-reproducible; mixing package managers across machines.

The trade-off is install speed (caching) versus reproducibility and catching undeclared dependencies early.

Checklist:

• Use lockfile-enforcing install mode in CI.
• Pin package-manager behavior.
• Key caches by lockfile and platform.
• Review lockfile diffs like application code.